Get a list of files, get some hashes, talk to some people, have a good day

package.json

@@ -58,17 +58,19 @@
   },
   "dependencies": {
     "@cyclonedx/bom": "~1.0.4",
+    "@types/elementtree": "^0.1.0",
     "@types/figlet": "^1.2.0",
+    "@types/glob": "^7.1.1",
     "@types/js-yaml": "^3.12.1",
     "@types/node": "^12.12.17",
     "@types/node-fetch": "^2.5.4",
     "@types/node-persist": "^3.0.0",
     "@types/yargs": "^13.0.3",
-    "@types/yarnpkg__lockfile": "^1.1.3",
-    "@yarnpkg/lockfile": "^1.1.0",
     "chalk": "^3.0.0",
     "colors": "^1.3.1",
+    "elementtree": "^0.1.7",
     "figlet": "^1.2.4",
+    "glob": "^7.1.6",
     "js-yaml": "^3.13.1",
     "node-fetch": "^2.6.0",
     "node-persist": "^3.0.5",

src/Application/Application.ts

@@ -30,6 +30,10 @@ import { Spinner } from './Spinner/Spinner';
 import { filterVulnerabilities } from '../Whitelist/VulnerabilityExcluder';
 import { IqServerConfig } from '../Config/IqServerConfig';
 import { OssIndexServerConfig } from '../Config/OssIndexServerConfig';
+import { Lister } from '../Hasher/Lister';
+import { Hasher } from '../Hasher/Hasher';
+import { Merger } from '../Merger/Merger';
+import { join } from 'path';
 
 export class Application {
   private results: Array<Coordinates> = new Array();
@@ -109,7 +113,6 @@ export class Application {
 
   private doPrintHeader(title: string = 'AuditJS', font: figlet.Fonts = '3D-ASCII') {
     console.log(textSync(title, { font: font }));
-    // console.log(textSync(pack.version, { font: font}));
   }
 
   private async populateCoordinates() {
@@ -123,10 +126,32 @@ export class Application {
     }
   }
 
+  private getHashesFromPath(paths: Set<string>, basePath: string = '') {
+    let promises: any[] = [];
+    let hasher = new Hasher('sha1');
+
+    paths.forEach((path) => {
+      promises.push(hasher.getHashFromPath(join(process.cwd(), basePath, path)));
+    })
+
+    return Promise.all(promises);
+  }
+
   private async populateCoordinatesForIQ() {
     try {
       logMessage('Trying to get sbom from cyclonedx/bom', DEBUG);
-      this.sbom = await this.muncher.getSbomFromCommand();
+      let files = Lister.getListOfFilesInBasePath(join(process.cwd(), 'bin'));
+
+      console.log(files);
+
+      await Promise.all([this.getHashesFromPath(files, 'bin'), this.muncher.getSbomFromCommand()])
+        .then(async (values) => {
+          let merger = new Merger();
+          this.sbom = await merger.mergeHashesIntoSbom(values[0], values[1]);
+
+          console.log(this.sbom);
+      });
+
       logMessage('Successfully got sbom from cyclonedx/bom', DEBUG);
     } catch(e) {
       logMessage(`An error was encountered while gathering your dependencies into an SBOM`, ERROR, {title: e.message, stack: e.stack});

src/Hasher/Hasher.spec.ts

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import expect from '../Tests/TestHelper';
+import { Hasher } from './Hasher';
+import mock from 'mock-fs';
+
+const json = `{"thing": "value"}`;
+
+const json2 = `{"anotherThing": "anotherValue"}`;
+
+const json3 = `{"yetAnotherThing": "yetAnotherValue"}`;
+
+describe("Hasher", () => {
+  it("should return a sha1 hash for a provided path", async () => {
+    mock({'/nonsensical': {
+      'auditjs.js': json,
+      'directory': {
+        'anotherpath.js': json2,
+        'fakething.js': json3,
+        'anotherdirectory': {}
+        }
+      } 
+    });
+
+    let expected = '54bbc009e6ba2ee4e892a0347279819bd30e5e29';
+
+    let hasher = new Hasher('sha1');
+
+    let result = await hasher.getHashFromPath('/nonsensical/auditjs.js');
+
+    expect(result)
+      .to.eq(expected);
+
+    mock.restore();
+  });
+});

src/Hasher/Hasher.ts

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs';
+import crypto from 'crypto';
+
+export class Hasher {
+  constructor(readonly algorithm: string = 'sha1') {}
+
+  public getHashFromPath(path: string): Promise<string> {
+    return new Promise((resolve, reject) => {
+      let fd = fs.createReadStream(path);
+      let hash = crypto.createHash(this.algorithm);
+      hash.setEncoding('hex');
+
+      fd.on('end', () => {
+        hash.end();
+        resolve(hash.read());
+      });
+
+      fd.on('error', (err) => {
+        reject(err);
+      });
+
+      fd.pipe(hash);
+    });
+  }
+}

src/Hasher/Lister.spec.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import expect from '../Tests/TestHelper';
+import { Lister } from './Lister';
+import mock from 'mock-fs';
+
+describe("Lister", () => {
+  it("should return a set of paths to js files and no directories given a base path", async () => {
+    mock({'/nonsensical': {
+      'auditjs.js': '{}',
+      'directory': {
+        'anotherpath.js': '{}',
+        'fakething.notjs': '{}',
+        'anotherdirectory': {}
+        }
+      } 
+    });
+
+    let expected = new Set();
+
+    expected.add('auditjs.js');
+    expected.add('directory/anotherpath.js');
+
+    let result = Lister.getListOfFilesInBasePath('/nonsensical');
+
+    expect(result)
+      .to.deep.eq(expected);
+
+    mock.restore();
+  });
+});

src/Hasher/Lister.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import glob from 'glob';
+
+export abstract class Lister {
+  public static getListOfFilesInBasePath(path: string): Set<string> {
+    let files = glob.sync(`**/*.js`, {nodir: true, cwd: path});
+
+    return new Set(files);
+  }
+}

src/Merger/Merger.ts

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2020-present Sonatype, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import elementtree from 'elementtree';
+
+export class Merger {
+  public async mergeHashesIntoSbom(hashes: string[], xml: string): Promise<string> {
+    return new Promise((resolve, reject) => {
+      let tree = elementtree.parse(xml);
+      let components = tree.find('./components');
+      if (!components) {
+        reject();
+      }
+      hashes.map((val) => {
+        if (components) {
+          let component = elementtree.SubElement(components, 'component')
+          let name = elementtree.SubElement(component, 'name');
+          let version = elementtree.SubElement(component, 'version');
+          let hash = elementtree.SubElement(component, 'hash');
+          hash.text = val;
+        } 
+      });
+      resolve(tree.write());
+    });
+  }
+}